CVE-2026-85351: vulnerability in FV Flowplayer Video Player
FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.
Affected products
Unknown · FV Flowplayer Video PlayerRelated CVEs — FV Flowplayer Video Player
In the same product, most dangerous first.
CVE-2026-85345MEDIUMFV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_dataEPSS 0.2%CVE-2026-108068LOWFV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration WizardEPSS 0.1%CVE-2026-108067LOWFV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOREPSS 0.1%CVE-2026-85347—FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox CaptionEPSS —CVE-2026-85346—FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser HandlersEPSS —